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CLASSIFIED DECLARATION OF DEBORAH A. BONANNI 
NATIONAL SECURITY AGENCY 

I, Deborah A. Bonanni, do hereby state and declare as follows; 

I. (U) Introduction 



1 . (U) I am the Chief of Staff for the National Security Agency (NS A), an 
intelligence agency within the Department of Defense. 1 have held this position since February 
2006. As the Chief of Staff, under our internal regulations, and in the absence of the Deputy 
Director and the Director, 1 am responsible for directing the NSA, overseeing the operations 
undertaken to carry out its mission and, by specific charge of the President and the Director of 
National Intelligence, protecting NSA activities and intelligence sources and methods. 1 have 
been designated an original TOP SECRET classification authority under Executive Order No. 
12958, 60 Fed. Reg. 19825 (1995), as amended on March 25, 2003, and Department of Defense 
Directive No. 5200 . 1-R, Information Security Program Regulation, 32 C.F.R. § 159a. 12 (2000). 

2. (U) The puipose of this declaration is to support an assertion of the military and 

state secrets privilege (hereafter “state secrets privilege’’) by the Director of National Intelligence 
(“DNl") as the head of the intelligence community, as well as the DNTs assertion of a statutory 
privilege under the National Security Act, to protect information related to NSA activities 
described herein below. Lieutenant General Keith Alexander, the Director of the National 
Security Agency, has been sued in his official and individual capacity in the above captioned cast 
and has recused himself from the decision of whether to assert the statutory privilege in his 
official capacity. As the Deputy Director is currently out of the office on temporary duty, by 
operation of our internal regulations and by specific delegation of the Director, I am authorized tc 
review the materials associated with this litigation, prepare whatever declarations 1 determine are 
appropriate, and determine whether to assert (he NSA's statutory privilege. Through this 
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declaration, I hereby invoke and assert the NSA’s statutory privilege set forth in SectioD 6 of the 
National Security Agency Act of 1959, Public Law No. 86-36 (codified as a note to 50 U.S.C. 

§ 402) (“NSA Act"), to protect the information related to NSA activities described herein below. 
The statements made herein are based on my personal knowledge of NSA activities and 
operations, and on information made available to me as the Chief of Staff of the NSA. 

II. (TJ ) Summary 

3 (U) In the course of my official duties, I have been advised of this litigation and 1 

have reviewed the allegations in the Complaint in this case. In sum, plaintiffs allege that, after 
the 9/1 1 attacks, the NSA received presidential authorization to engage iD surveillance activities 
far broader than the publicly acknowledged ‘Terrorist Surveillance Program" (‘TSP"), which 
involved the interception of specific international communications involving persons reasonably 
believed to be associated with al Qaeda and affiliated terrorist organizations. Plaintiffs allege 
that the NSA, with the assistance of telecommunication companies including AT&T, has 
indiscriminately intercepted the content and obtained the communications records of millions of 
ordinary Americans as part of an alleged presidentially-authorized "Program" after 9/1 1 . See 
Complaint at 2-1 3; 39-97. J cannot disclose on the public record the nature of any NSA 
information implicated by the plaintiffs’ allegations. However, as described further below, the 
disclosure of information related to the NSA’s activities, sources and methods implicated by the 
plaintiffs’ allegations reasonably could be expected to cause exceptionally grave damage to the 
national security of the Uniled States and, for this reason, are encompassed by the DNI’s state 
secrets and statutory privilege assertions, as well as by my assertion of the NSA statutory 
privilege, and should be protected from disclosure in this case. In addition, il is my judgment 
that sensitive state secrets are so central to the subject matter of the litigation that any attempt to 
proceed in the case risks the disclosure of the classified privileged national security information 
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4. f TStfT S lV/ S l//OC/N F> The allegations in this lawsuit put at issue the disclosure 
of information concerning several highly classified and critically important NSA intelligence 
activities that commenced after the 9/1 1 terrorist attacks, but which are now conducted pursuant 
to authority of the Foreign Intelligence Surveillance Act (“FISA”), including ongoing activities 
conducted under orders approved by the Foreign Intelligence Surveillance Court (“FISC”). 
Piaintiffs’ allegation that the NSA undertakes indiscriminate surveillance of the content 1 of 
millions of communications sent or received by people inside the United States— under the now 
defunct-TSP or otherwise— is false, as discussed below. The NSA ’s collection of the content of 
communications under the TSP was directed at international communications tn which a 
participant was reasonably believed to be associated with al Qaeda or an affiliated organization : 
and did not constitute the kind of dragnet collection of the content of millions of Americans’ 
telephone or Internet communications that the plaintiffs allege. Although the existence of the 
TSP has been acknowledged, the details of that program remain highly classified, along with 
details of related content surveillance activities undertaken after the TSP pursuant to orders of 
the FISC. This information could not be disclosed to address or disprove or otherwise litigate 
the plaintiffs’ allegation of a content dragnet without causing exceptional harm to NSA’s sources 
and methods of gathering intelligence— including methods currently used to detect and prevent 
further terrorist attacks under the authority of (he FISA. 

5. -fTS //T ^// S t // OC/NF)- In addition, as the Court should also be aware from prior 
classified declarations submitted by the NSA in related proceedings, the NSA has collected, 
pursuant to presidential authorization and currently under subsequent FISC orders, non-content 

1 (TS// S I//OC - /NF) The term “content” is used herein to refer to the substance, meaning, 
or purport of a communication, as defined in 1 8 U.S.C § 2510(8), as opposed to the type of 
addressing or routing information referred throughout this declaration as “meta data ” 
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information (/ <? , mete data) about telephom!~^^^^B;t communications in order to enable 
highly sophisticated analytical tools that can uncover the contacts 



members or agents o 



As noted above and detailed 



below, the content surveillance subject to presidential authorization after 9/1 1 was not the 
content dragnet surveillance that plaintiffs allege, and the collection of non-content information, 
while significant in scope remains a highly classified matter currently under FISA authorization. 
For the NSA to attempt to explain, clarify, disprove, or otherwise litigate plaintiffs’ allegations 
regarding a communications dragnet would require the NSA to confirm the existence of, or 
disclose facts concerning, intelligence sources and methods for the collection of non-content 
information related to communications, as well as current NSA operations under FISC Orders— 
disclosures that would cause exceptional harm to national security. 

6. S P/ /OC/NT) In addition, plaintiffs’ allegation that 

telecommunications carriers, in particular AT&T, assisted the NSA in alleged intelligence 
activities cannot be confirmed or denied without risking exceptionally grave harm to national 
security. Because the NSA has not undertaken the alleged dragnet collection of communications 



content, no carrier has assisted in that alleged activity. 



ISC Orders are also directed at| 

Because th^Uleeation^rUh^omplainn^ 
after were directed at any 

further references to the FISC Orders wijU^ussolel^r^chvitie^ande^h^rde^OirectM at 
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national security. 

7. (-T-S//Sl-|H^B t /TSP//0€W ! )-According]y > the DNI’s state secrets and 



statutory privilege assertions, and my own statutory privilege assertion, seek to protect against 
the disclosure of the highly classified intelligence sources and methods put at issue in this case 
and vital to the national security of the United States, including: (1) any information that would 
tend to confirm or deny whether particular individuals, including the named plaintiffs, have been 
subject to the alleged NSA intelligence activities; (2) information concerning NSA intelligence 
sources and methods, including facts demonstrating that the content collection under the TSP 
was limited to specific al Qaeda and associated terrorist-related international communications 
and was not a content surveillance dragnet as plaintiffs allege; (3) facts that would tend to 
confirm or deny the existence of the NSA’s bulk meta data collection and use, and any 
information about those activities; and (4) the fact that | 

The fact that there has been public speculation 
about alleged NSA activities does not diminish the need to protect intelligence sources and 
methods from further exposure. Official confirmation and disclosure of the classified privileged 
national security information described herein would cause exceptionally grave damage to the 
national security. For these reasons, as set forth further below, 1 request that the Court uphold 
the state secrets and statutory privilege assertions that the DNT and I now make, and protect the 
information described in this declaration from disclosure. 
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III (U) Classification of Declaration 



8, i&mimF) This declaration is classified TOP SECRET//TSP//STECI 
^^JoRCON/NOFORN pursuant to the standards in Executive Order No. 12958, as amended 
by Executive Order No. 13292. Under Executive Order No. 12958, information is classified 
“TOP SECRET’ if unauthorized disclosure of the information reasonably could be expected to 
cause exceptionally grave damage to the national security of the United States; “SECRET” if 
unauthorized disclosure of the information reasonably could be expected to cause serious 
damage to national security, and “CONFIDENTIAL'’ if unauthorized disclosure of the 
information reasonably could be expected to cause identifiable damage to national security. At 
the beginning of each paragraph of this declaration, the letter or letters in parentheses 
designated) the degree of classification of the information the paragraph contains When used 
for this purpose, the letters ‘TJ/’ ll C t " “S,” and “TS” indicate respectively that the information is 
either UNCLASSIFIED, or is classified CONFIDENTIAL, SECRJET, or TOP SECRET 3 . 

9. -(S // S I//N F)- Additionally, this declaration also contains Sensitive Compartmented 
Information (SCI), which is “information that not only is classified for national security reasons 
as Top Secret, Secret, or Confidential, but also is subject to special access and handling 
requirements because it involves or derives from particularly sensitive intelligence sources and 
methods.” 28 C.F.R. § 17.18(a). Because of the exceptional sensitivity aad vulnerability of such 
information, these safeguards and access requirements exceed the access standards that are 
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normally required for information of the sam^^H^Stion level. Specifically, this declaration 
references communications intelligence (COMrNT), also referred to as special intelligence (SI), 
which is a subcategory of SCI. COMfNT or SI identifies SCI that was derived from exploiting 
cryptographic systems or other protected sources by applying methods or techniques, or from 
intercepted foreign communications. 

10. This declaration also contains information 

related to or derived from the Terrorist Surveillance Program (TSP), a controlled access signals 
intelligence program under presidential authorization in response to the attacks of September 1 1 , 
2001 . Although TSP was publicly acknowledged hy then-President Bush in December 2005, 
details about the program remain highly classified and strictly compartmented. Information 
pertaining to this program is denoted with the special marking “TSP” and requires more 
restrictive, handling. 



1 1 . -fS#S I//NT )- In addition to the fact that classified information contained herein 
may not be revealed to any person without authorization pursuant to Executive Order 12958, as 
amended, this declaration contains information that may not be released to foreign governments, 
| foreign nationals, or non-U .S. citizens without permission of the originator and in accordance 
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with DNI policy. This information is labeled IC NOFORN.’ 5 The “ORCON” designator means 
that the originator of the information controls to whom it is released. I 

IV, tut Background Information 
A, (U) The National Security Agency 

12- (li) The NS A was established by Presidential Directive in ] 952 as a separately 
organized agency within the Department of Defense. The NSA’s foreign intelligence mission 
includes the responsibility to collect, process, analyze, produce, and disseminate signals 
intelligence (S1GINT) information, of which communications intelligence {^COMTNT”) is a 
significant subset, for (a) national foreign intelligence purposes, (b) counterintelligence purposes, 
and (c) the support of military operations. See Executive Order 12333, § 1 .7(c), as amended. 5 

1 3, f T S /ZS t) Signals intelligence (SIGINT) consists of three subcaiegories: 

(1) communications intelligence (COMINT); (2) electronic intelligence (ELINT); and (3) foreign 
instrumentation signals intelligence (FISINT), Communications intelligence (COMINT) is 
defined as “all procedures and methods used in the interception of communications and the 
obtaining of mfonmation from such communications by other than the intended recipients/’ 1 8 
U.S,t § 798, COMINT includes information derived from the interception of foreign and 

I 

international communications, such as voice, facsimile, and computer- to- computer information 
conveyed via a number of means 

Electronic intelligence (ELINT) is technical intelligence information derived from 
foreign non-communications electromagnetic radiations except atomic detonation or radioactive 
sources-in essence, radar systems affiliated with military weapons platforms {e.g.> anti-ship) and 
civilian systems (eg,, shipboard and air traffic control radars). Foreign instrumentation signals 





28 



5 (U) Section L7(c) of EO* 12333, as amended, specifically authorizes the NSA to 
“Collect (including through clandestine means), process, analyze, produce, and disseminate 
signals intelligence information for foreign intelligence and counterintelligence purposes to 
support rational and departmental missions/ 1 
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intelligence (F)SrNT) is derived from non-U. S. aerospace surfaces and subsurface systems which 

may have either military or civilian applications. 

14. ~ ( Sy / S I//NF) The NSA's SIGINT responsibilities include establishing and 
operating an effective unified organization lo conduct SIGINT activities set forth in Executive 
Order No. 12333, § 1.12(b), as amended. In performing its SIGINT mission, NSA has 
developed a sophisticated worldwide SIGINT collection network that acquires, among other 
things, foreign and international electronic communications and related information. The 
technological infrastructure that supports the NSA’s foreign intelligence information collection 
network has taken years to develop at a cost of billions of dollars and untold human effort. It 
relies on sophisticated collection and processing technology. 

1 5 (TJ) There are two primary reasons for gathering and analyzing foreign 
intelligence information. The first, and most important, is to gain information required to direct 
U S. resources as necessary to counter external threats and in support of military operations. The 
second reason is to obtain information necessary to the formulation of US. foreign policy. 
Foreign intelligence information provided by the NSA is thus relevant to a wide range of 
important issues, including military order of battle; threat warnings and readiness; arms 
proliferation; international terrorism; counter-intelligence; and foreign aspects of international 
narcotics trafficking. 

16. - <S// 6t/ /N f^The NSA’s ability to produce foreign intelligence information 

depends on its access to foreign and international electronic communications. Foreign 
intelligence produced by COMINT activities is an extremely important part of the overall foreign 
intelligence information available to the United Slates and is often unobtainable by other means. 
Public disclosure of either the capability to collect specific communications or the substance of 
the information derived from such collection itself can easily alert targets to the vulnerability of 
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their communications. Disclosure of even a single communication holds the potential of 

revealing intelligence collection techniques that are applied against targets around the world. 

Once alerted, targets can frustrate COMfNT collection by using different or new encryption 

techniques, by disseminating disinformation, or by utilizing a different communications link. 

Such evasion techniques may inhibit access to the target’s communications and therefore deny 

the United States access to information crucial to the defense of the United States both at home 

and abroad. COMINT is provided special statutory protection under 18 U.S.C. § 798, which 

makes it a crime to knowingly disclose to an unauthorized person classified information 

"concerning the communication intelligence activities of the United States or any foreign 

government.” 

B, (U) September 11, 2001 and the al Qaeda Threat 

1 7. (U) On September 1 1 , 200 1 , the al Qaeda terrorist network launched a set of 

coordinated attacks along the East Coast of the United States. Four commercial jetliners, each 
carefully selected to be fully loaded with fuel for a transcontinental flight, were hijacked by al 
Qaeda operatives. Those operatives targeted the Nation’s financial center in New York with two 
of the jetliners, which they deliberately flew into the Twin Towers of the World Trade Center. 

Al Qaeda targeted the headquarters of the Nation’s Armed Forces, the Pentagon, with the third 
jetliner. Al Qaeda operatives were apparently headed toward Washington, D.C. with the fourth 
jetliner when passengers struggled with the hijackers and the plane crashed in Shanksville, 
Pennsylvania. The intended target of this fourth jetliner was most evidently the White House or 
the Capitol, strongly suggesting that al Qaeda's intended mission was to strike a decapitation 
blow to the Government of the United States — to kill the President, the Vice President, or 
Members of Congress. The attacks of September 1 1 resulted in approximately 3,000 deaths — 
the highest single-day death toll from hostile foreign attacks in the Nation's history. In addition, 
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these attacks shut down air travel in the United States, disrupted the Nation’s financial markets 

and government operations, and caused billions of dollars of damage to the economy. 

18. (If) On September 14, 2001 , a national emergency was declared “by reason of the 
terrorist attacks at the World Trade Center, New York, New York, and the Pentagon, and the 
continuing and immediate threat of further attacks on the United States.” Presidential 
Proclamation No. 7463, 66 Fed. Reg. 48199 (Sept. 14, 2001). The United States also 
immediately began plans for a military response direcled at al Qaeda’s training grounds and 
havens in Afghanistan. On September 14, 2001 , both Houses of Congress passed a Joint 
Resolution authorizing the President of the United States “to use atl necessary and appropriate 
force against those nations, organizations, or persons he determines planned, authorized, 
committed, or aided the terrorist attacks” of September 1 1 . Authorization for Use of Military 
Force, Pub. L. No. 1 07-40 § 2 1 (a), 1 1 5 Stat. 224, 224 (Sept. 1 8, 200 1 ) (“Cong. Auth ”). 

Congress also expressly acknowledged that the attacks rendered it “necessary and appropriate” 
for the United States to exercise its right “to protect United States citizens both at home and 
abroad,” and acknowledged in particular that “the President has authority under tbe Constitution 
to take action to deter and prevent acts of international terrorism against the United States.” Id. 
pmb]. 

t9. (TJ) Also after the 9/1 1 attacks, a Military Order was issued stating that the attacks 
of September 1 1 “created a slate of armed conflict,” see Military Order by the President § 1(a), 

66 Fed. Reg. 57833, 57833 (Nov. 13, 2001), and that al Qaeda terrorists “possess both the 
capability and the intention to undertake further terrorist attacks against the United States that, if 
not detected and prevented, will cause mass deaths, mass injuries, and massive destruction of 
property, and may place at risk the continuity of the operations of the United Stales 
Government,” and concluding that “an extraordinary emergency exists for national defense 
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purposes.” Military Order^ § 1(c), (g), 66 Fed. Reg. at 57833-34. Indeed, shortly after the 
attacks, on October 2, 2001 , NATO took the unprecedented step of invoking Article 5 of the 
North Atlantic Treaty, which provides that an 4C armed attack against one or more of [the parties] 
shall be considered an attack against them all/’ North Atlantic Treaty, Apr. 4, 1949, art. 5, 63 



3 tat 2241, 2244, 34 U.N.T.S. 243, 246. 

20. (U) As a result of the unprecedented attacks of September 1 1 , 2001, the United 
States found itself immediately propelled into a worldwide war against a network of terrorist 
groups, centered on and affiliated with a) Qaeda, that possesses the evolving capability and 
intention of inflicting further catastrophic attacks on the United States. That war is continuing 
today, at home as well as abroad. Moreover, the war against al Qaeda and its allies is a different 
kind of war, against a very different enemy, than any other war or enemy the Nation has 
previously faced. Al Qaeda and its supporters operate not as a traditional nation-state but as a 
diffuse, decentralized global network of individuals, cells* and loosely associated, often disparate 
groups, that act sometimes in concert, sometimes independently, and sometimes in the United 
States, but always in secret — and their mission is to destroy lives and to disrupt a way of life 
through terrorist acts. Al Qaeda works in the shadows, secrecy is essential to al Qaeda’s success 
in plotting and executing its terrorist attacks. 

2 1 . (TS//S I / / NF) The Classified In Camera , Ex Parte Declaration of Admiral Dennis 
C. Blair, Director of National Intelligence, details the particular facets of the continuing al Qaeda 
threat and, thus, the exigent need for the NSA intelligence activities described here. The NSA 

activities arc directed at that t hreat , 

Global telecommunications networks, especially the Internet, have 
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developed in recent years into a loosely interconnected system — a network of networks — that is 
ideally suited for the secret communications needs ofloosely affiliated terrorist cells. Hundreds 
of Internet service providers, or “ISPs,” and other providers of communications services offer a 
wide variety of global communications options, often free of charge. 
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23, fTStfS J// OC /N F) Our efforts against at Qaeda and its affiliates therefore present 
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critical challenges for the Nation's communications intelligence capabilities. First, in this new 
kind of war, more than in any other we have ever faced, communications intelligence is essential 
to our ability to identify the enemy and to detect and disrupt its plans for further attacks on the 
United States* Communications intelligence often is the only means we have to learn the 
identities of particular individuals who are involved in terrorist activities and the existence of 
particular terrorist threats. Second, at the same time that communications intelligence is more 
important than ever, the decentralized, non-hierarchica] nature of the enemy and their 
sophistication in exploiting the agility of modem telecommunications make successful 
co mm uni cations intelligence more difficult than ever. It is against this backdrop that the risks 
presented by this litigation should be assessed, in particular the risks of disclosing particular 
NSA sources and methods implicated by the claims. 

C. (U) Summary of NSA Activities After 9/1 1 to Meet al Qaeda Threat, 

24 (T S// Si//Q€/NF) After the September 1 1 attacks, the NSA received presidential 

authorization and direction to detect and prevent further terrorist attacks within the United States 
by intercepting the content of telephone and Internet communications for which there were 
reasonable grounds to believe that (1) such communications originated or terminated outside the 
United States and (2) o party to such communication was a member or agent of a) Qaeda or an 
affiliated terrorist organization. The existence of this activity was disclosed by then -President 
Bush in December 2005 (and subsequently referred to as the “Terrorist Surveillance Program” or 
“TSP”). 7 



7 (U) On January 17, 2007, the Attorney Genera] made public the general facts that new 
orders of the Foreign Intelligence Surveillance Court had been issued that authorized the 
Government to target for collection international communications into or out of the United States 
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25, ( : F'S-//'TSdfV/S' b c / & 0 / N~ P) In more specific and classified terms, the NSA has 

utilized a number of critically important intelligence sources and methods to meet the threat of 

another mass casualty terrorist attack on the United States — methods that were designed to work 

in tandem and continue to this day under authority of the FISC. As noted above, one such 

method involved the program publicly acknowledged by then-President Bush as the TSP, in 

which the NSA intercepted the content of telephone and Internet communications pursuant to 

presidential authorization * As described further below, under the TSP, NSA did not engage in 

plaintiffs' alleged dragnet surveillance of communication content, but intercepted the content of 

particular communications where reasonable grounds existed to believe one party involved a 

member of agent or al Qaeda or affiliated terrorist organization based on particular ''selectors” 

(phone numbers or Internet addresses) associated with that target. In addition to collecting the 

content of particular communications, the NSA has also collected non-content communication 

information known as 4t meta data.” Specifically, after the 9/1 1 attacks, the NSA collected bulk 

meta data related to telephony communications for the purpose of conducting targeted analysis to 



where there is probable cause to believe that one of the communicants is a member or agent of al 
Qaeda or an associated terrorist organization; that, as a result of these orders, any electronic 
surveillance that had been occurring as part of the TSP was then being conducted subject to the 
approval of the FISA Court, and that, under these circumstances, the TSP was not reauthorized 



fPSflTSFV/S l//0€/N F) The first presidential authorization of the TSP was on October 
4, 2001, and the TSP was reauthorized approximately every 30-60 days throughout the existence 
of the program, The documents authorizing the TSP also contained the authorizations for the 
meta data activities described herein, The authorizations, moreover, evolved over time, and 
during certain periods authorized other activities (this declaration is not intended to and does not 
fully describe the authorizations and the differences in those authorizations over time 



See In Camera , Ex Parte 
exander at J 62, MDL No. 06- 1 791 -VKW (N.D. 



Classified in Camera. Ej Parte Declaration of Deborah A, Bonanni, National Security Agency 
Carolyn Jewel, et of. v. National Security ef al (No O^HlU^RW) 






1 

2 

3 

4 

5 

6 
7 
S 

9 

10 
M 
12 
13 
H 

15 

16 
17 
IS 

19 

20 
21 
22 

23 

24 

25 

26 

27 

28 




Telephony meta data is information derived from call detail 
records that reflect non-content information such as, but not limited to, the date, time, and 
duration of telephone calls, as well as the phone numbers used to place and receive the calls. 9 In 
addition, since the 9/1 1 attacks, the NSA has collected bulk meta data related to Internet 
communications. Internet meta data is header/router/addressing information, such as the ‘to,” 
“from,” “cc” and “bcc” lines, as opposed to the body or “re” lines, of a standard email 

26. (T ^ ^S 4 //OC/N fi Each of the foregoing activities continues in some form under 
authority of the FISA and, thus* the NSA utilizes the same intelligence sources and methods 
today to detect and prevent further terrorist attacks that it did after the 9/1 1 attacks. First, as 
noted above, on January 1 0> 2007, the FISC issued two orders authorizing the Government to 
conduct certain electronic surveillance that had been occurring under the TSP. The FISC Orders 
were implemented on January 17, 2007 and, thereafter, any electronic surveillance that had been 
occurring as part of the TSP became subject to the approval of the FISC and the TSP was not 
reauthorized. 10 




these orders with some modifications, and the Foreign Telephone and Email Order later expired 
in August 2007 and was supplanted by authority enacted by Congress first under the Protect 
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27. f T S#S- l// Q€/NP) Second, witiHespecUo the collection of telephony meta data, 
since May 2006 certain telecommunication providers have been required by an order of the FISC 
to produce to the NS A on a daily basis all telephony meta data that they create (“FISC Telephone 
Business Records Order”). The FISC Telephone Business Records Order has been reauthorized 
approximately every 90 days since it was first issued. Although this collection is broad in scope, 
the NSA was authorized by the FISC to query the archived telephony data with identified 
telephone numbers for which there are facts giving rise to a reasonable, articulable suspicion that 



the number is associated with 



(hereafter referred to 



as a “RAS” determination). 1 1 Historically, only a tiny fraction of telephony meta data records 
collected by the NSA has actually been presented to a trained professional for analysis. As 
discussed further below (see 49-57 infra), while the vast majority of records are thus never 
viewed by a human at the NSA, it is still necessary to collect the meta data in bulk in order to 
utilize sophisticated and vital analytical tools for tracking the contacts 

for protecting the national security of the United States. 



I America Act and then the FISA Amendments Act of 2008 to authorize foreign intelligence 
surveillance of targets located overseas without individual court orders. 

11 (T S // S I//OC/ NF) As set forth further below 61-63 infra), NSA’s compliance with 
j this limitation in the FISC Order has been subject to further proceedings in the FISC that 
! commenced with a compliance report by the government on January 1 5, 2009, which indicated 
that the NSA had also been querying incoming telephony meta data with selectors for 
counterterrorism targets subject to NSA surveillance under Executive Order 12333, as to which 
the NSA had not made a “RAS” determination. On March 2, 2009, the FISC renewed the Order 
authorizing the bulk provisioru^NS^o^usiness records containing telephony meta data from 
telecommunications subjected that activity to new limitations, 

including that the NSA may query the meta data only after a motion is granted on a case-by-case 
basis (unless otherwise necessary to protect against imminent threat to human life). The FISC 
also required the Government to report to the FISC on its review of revisions to the meta data 
collection and analysis process, and that report shall include affidavits describing the value of the 
collection of telephony meta authorized by the FISC Telephone Business Records Order. 
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28. Third, beginning in July 2004, the collection of Internet meta 

data jn bulk has been conducted pursuant to an order of the FISC authorizing the use of a pen 
register and trap and trace device (“FISC Pen Register Order* or “PRTT Order”). See !8 ITS C 
§ 3 1 27 (defining '"pen register” and “trap and trace device"'). Pursuant to the FISC Pen Register 
Order, which has been reauthorized approximately every 90 days since it was first issued, the 
NSA is authorized to collect, in bulk, meta data associated with electronic communications 




■■it has been authorized by the FISC to query the archived meta data only using email 
addresses for which there are facts giving rise to a reasonable, articulable suspicion that the email! 



address is associated with 



[(similar restrictions were 



in place under the presidential authorization). As with bulk telephony meta data collection, bulk 
Internet meta data collection is necessary to allow the NSA to use critical and unique analytical 



capabilities to track the contacts (even retrospectively) 



>f known 



terrorists. Like telephony meta data activities, Internet meta data collection and analysis are vital 
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tools for protecting the United States from attack^na^ccordingly, information pertaining to 

those activities is highly classified. 13 

V. flj) Information Protected by Privilege 

29. (TJ) In genera) and unclassified terms, the following categories of information are 

sub ject to the DNl’s assertion of the slate secrets privilege and statutory privilege under the 

National Security Act, as well as my assertion of the NSA statutory privilege: 

A. Information that may tend to confirm or deny whether the 
plaintiffs have been subject to any alleged NSA intelligence 
activity that may be at issue in this matter; and 

B. Any information concerning NSA intelligence activities, 
sources, or methods that may relate to or be necessary to 
adjudicate plaintiffs' allegations, including allegations that 
the NSA, with the assistance of telecommunications 
carriers such as AT&T, indiscriminately intercepts the 
content of communications and also collects the 
communication records of millions of Americans as part of 
an alleged presidentially authorized “Program” after 9/1 1 . 

See, e.g.y Complaint at VI 2-13; 39-97. 

The scope of this assertion includes but is not limited to: 

(i) Information concerning the scope and operation 
of the now inoperative ‘Terrorist Surveillance Program” 

{“TSP”) regarding the interception of the coQlent of certain 
one-end international communications reasonably believed 
to involve a member or agent of al-Qaeda or an affiliated 
terrorist organization, and any other information related to 
demonstrating that the NSA does not otherwise engage in 
the content surveillance dragnet that the plaintiffs allege; 
and 



(ii) Information concerning whether or not the NSA 
obtained from telecommunications companies such as 



13 (TS//T&fV/ SI//OC/NF) As the NSA has previously advised the Court in related 
proceedings, and describes further below (see note 2^>?/rii), the bulk collection of Internet meta 
data pursuant to presidential authorization ceased in ^^^2004. See In Camera , Ex Parte 
Classified Declaration of Lt. Gen. Keith B. Alexander at ^ 31 n.8, MDL No. 06-1791-VRW 
(N.D. Cal.) (relating to all actions against the MCI and Verizon Defendants) (submitted Apr. 20, 
2007). 
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AT&T communication TrarTsactuTnal records as alleged in 
the Complaint; see, e>g- t Complaint Tffl 10; 82-97; and 



(iii) Information that may tend to confirm or deny 
whether AT&T (and to die extent relevant or necessary, 
any other telecommunications carrier}, has provided 
assistance to the NS A in connection with any alleged 
activity. 



VI. CU) Description ofln formation Subject to Privilege and the Harm of Disclosure 



A. (11) Information That May Tend to Confirm or Deny Whether the Plaintiffs Have 
Been Subject to Any Alleged NS A Activities. 

30. (U) The first major category of information as to which I am supporting the DNTs 

assertion of privilege, and asserting the NS A* s own statutory privilege, concerns information as 
to whether particular individuals, including the named plaintiffs in this lawsuit, have been 
subject to alleged NS A intelligence activities. As set forth below, disclosure of such information 
would cause exceptionally grave harm to the national security. 



fTSffSft 




3 1 . (TS//T&g//SI//OC/NF) The five named plaintiffs in this case — Tash Hcpting, 
Gregory Hicks, Carolyn Jewel, Erik Knutzen and Joice Walton have alleged that, pursuant to a 
presidential^ authorized program after the 9/1 1 attacks, the NS A, with the assistance of AT&T, 
has acquired and continues to acquire the content of phone calls, emails, instant messages, text 
messages, web and other communications, both international and domestic, of millions of 
ordinary Americans— "practically every American who uses the phone system or the Internet" — 
including the plaintiffs, as well as private telephone and Internet transaction records of millions 
of AT&T customers, again including information concerning the plaintiffs* telephone and 
Internet communications. See, e.g., Complaint Yl 7, 9, 10; see also Ifll 39-97, As set forth 
herein, the NS A does not engage in "dragnet" surveillance of the content of communications as 
allege, 



Classified In Camera, Parte Declaration of Deborah A. Bonanni, National Security Agency 



Carolyn Jewel, tt at v National Security Agency, et at (No. 

TOP S - ECR E : 17VTSP#S4- 




RW) 

'/ Oft f '- AN / M O FOR M 

rt7T> 1 i ' i'hj r\7 “ M 



23 





34. (€) As a matter of course, the NS A cannot publicly confirm or deny whether any 



individual is subject to surveillance activities because to do so would tend to reveal actual 
targets. For example, if the NSA were to confirm in ibis case and others that specific individuals 
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B. (U) Information Related to NSA Activities, Sources, or Methods Implicated by the 
Plaintiffs 1 Allegations and the Harm to National Security of Its Disclosure. 

1. (II) Plaintiffs’ Allegations of a Communications Dragnet. 



36, (U) 1 am also supporting the DNJ’s assertion of privilege and asserting the NSA's 

statutory privilege over any other facts concerning NS A intelligence activities, sources, or 
methods that may relate to or be necessary to litigate the plaintiffs’ claims and allegations, 
including that (i) the NSA is indiscriminately intercepting the content of communications of 
millions of ordinary Americans, see, eg.. Complaint 7, 9, 10, and (ii) that the NSA is 
collecting the private telephone and Internet transaction records of millions of AT&T customers, 
again including information concerning the plaintiffs' telephone and Internet communications. 
See e.g. f Complaint ^ 7, 9, 10, 13, 82-97. As described above, the scope of the government's 
privilege assertion includes but is not limited to: ( 1 ) facts concerning the operation of the now 
inoperative Terrorist Surveillance Program and any other NSA activities needed to demonstrate 
that the TSP was limited to the interception of the content of one-end international 
communications reasonably believed to involve a member or agenl of aJ Qaeda or an affiliated 
terrorist organization and that the NSA does not otherwise conduct the content surveillance 
dragnet that the plaintiffs allege; and (2) information concerning whether or not the NSA obtains 
transactional communication records from telecommunications companies such as AT&T as 
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plaintiffs allege. As sel forth below, the disclosure of such information would cause 
exceptionally grave harm to national security. 

(a) (TJ) Information Related to the Terrorist Surveillance Program . 

37. (U) After the existence of the TSP was officially acknowledged in December 
2005, the Government stated that the NSA’s collection of the content of communications under 

\ the TSP was directed at international communications in which a participant was reasonably 
1 believed to be associated with al Qaeda or an affiliated organization. Plaintiffs' allegation that 
the NSA has undertaken indiscriminate surveillance of the content of millions of 
communications sent or received by people inside the United States after 9/1 1 under the TSP is 
therefore false, again as the Government has previously stated.’ 9 But to the extent the NSA must 
demonstrate that content surveillance under the TSP was so limited, and was not plaintiffs’ 
alleged content dragnet, or demonstrate that the NSA has not otherwise engaged in the alleged 
content dragnet, highly classified NSA intelligence sources and methods about the operation of 
the TSP and NSA intelligence activities would be subject to disclosure or the risk of disclosure. 
The disclosure of whether and to what extent the NSA utilizes certain intelligence sources and 
methods would reveal to foreign adversaries the NSA’s capabilities, or lack thereof, enabling 
them to either evade particular channels of communications that are being monitored, or exploit 
channels of communications that are not subjeci to NSA activities — in either case risking 
exceptionally grave harm to national security. 

38. (U) The privileged information that must be protected from disclosure includes 
the following classified details concerning content surveillance under the now inoperative TSP. 

39. (TS//TSP / /S f / / CKyNP) First, interception of the content of communications 
under the TSP was triggered by a range of information, including sensitive foreign intelligence, 

19 See, e.g., Public Declaration of NSA Director Alexander in the Skubert action (07-cv- 
693-VR.W) at K 16. 
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obtained or derived from various sources indicating that a particular phone number or email 
address is reasonably believed by the U.S, Intelligence Community to be associated with a 
member or agent of al Qaeda or an affiliated terrorist organization. Professional intelligence 
officers at the NS A undertook a careful but expeditious analysis of that information, and 
considered a number of possible factors, in determining whether it would be appropriate to target 
a telephone number or email address under the TSP. Those factors included whether the target 
phone number or email address was: (1) reasonably believed by the U.S. Intelligence 
Community, based on other authorized collection activities or other law enforcement or 
intelligence sources, to be used by a member or agent of al Qaeda or an affiliated terrorist 
organization; 
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D 



The NSA did not search the content of the 
with “key words” other than the targeted selectors 
themselves, Rather, the NSA targeted for collection only email addresses 

associated with suspected members or agents of al Qaeda or affiliated terrorist 



organizations, or communications in which such 



were mentioned In 



addition, due to technical limitations of the hardware and software, incidental collection of non- 
target communications has occurred, and in such circumstances the NSA applies its 
minimization procedures to ensure that communications of non-targets ore not disseminated. To 
the extent such facts would be necessary to dispel plaintiffs’ erroneous content dragnet 
allegations, they could not be disclosed without revealing highly sensitive intelligence methods, 
45. ( TS / /TSP / / S 1//QO / NF) In addition to procedures designed to ensure that the TSP 
was limited to the international communications of al Qaeda members and affiliates, the NSA 
also took additional steps to ensure that the privacy rights ofU.S. persons were protected. 
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The 



foregoing information about the targeted scope of content collection under the TSP could not be 
disclosed, in order to address and rebut plaintiffs’ allegation that the NSA, with the assistance of 
AT&T, engaged in the alleged content dragnet, without revealing specific NSA sources and 
methods and thereby causing exceptionally grave damage to the national security. 



22 (U/FOUO) In addition, in implementing the TSP, the NSA applied the existing Legal 
Compliance and Minimization Procedures applicable to U.S, persons to the extent not 
inconsistent with the presidential authorization. See United States Signals Intelligence Directive 
(USSID) 18, These procedures require that the NSA refrain from intentionally acquiring the 
communications of U.S. persons who are not the targets of its surveillance activities, that it 
destroy upon recognition any communications solely between or among persons in the U.S. that 
it inadvertently acquires, and that it refrain ffom identifying U.S. persons in its intelligence 
reports unless a senior NSA official determines that the recipient of the report requires such 
information in order to perform a lawful function assigned to it and the identity of the U.S. 
person is necessary to understand the foreign intelligence or to assess its significance, 
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Complaint 7, 9, 10, 13, 82-97. Confirmation or denial of any information concerning whether 



the NSA collects communication records would also disclose information about whether or not 
the NSA utilizes particular intelligence sources and methods and, thus, the NSA'S capabilities or 
lack thereof, and would cause exceptionally grave harm to national security. 

49. f¥S//S I//OC/NF) In addition to implicating the NSA’s content collection 
activities authorized after Lhe 9/1 1 attacks, Lhe plaintiffs' allegations also put directly at issue the 
NSA’s bulk collection of non-content communication meta data. As explained above, the NSA 
has not engaged in the alleged dragnet of communication content, and, as now explained below, 
to address plaintiffs' allegations concerning the bulk collection of non-content information 
would require disclosure of NSA sources and methods that would cause exceptional harm to 
national security. As also explained herein, these meta data collection activities are now subject 
to the orders and supervision of the FISC. 



50. As noted above, starting in October 2001 , and since 

2004 pursuant to the FISC Pen Register Order, the NSA collected bulk meta data associated with 
electronic communications 



See tH 25, 28, supra 2 



a » til 
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he only effective means by which NS A analysis are able continuously 
to keep track of such operatives is through meta data collection and analysis. 



■ Technical Details of Analytic Capabilities 



52. (TS/ /S1 //O C/ N ~ P ) In particular, the bulk collection of Internet and telephony meta 

data allows the NSA to use critical and unique analytical capabilities to track the contacts BH 





55. Because it is impossible to determine in advance 

which particular piece of meta data will turn out to identify a terrorist, collecting meta data in 
bulk is vital for the success of contact-chaining NS A analysts know that the| 

terrorists’ telephone calls are located somewhere in the billions of data bits; what they cannot 
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! know ahead of time is exactly where. The ability to accumulate meta data substantially increases 

2 NSA’s ability to delect and identify these targets. One particular advantage of bulk meta data 

3 collection is that it provides a historical perspective on past contact activity that cannot be 

A 

captured in the present or prospectively. Such historical links may be vital to identifying new 

s 

targets, because the meta data may contain links that are absolutely unique, pointing to potential 
targets missed. 



These sources and methods enable the NS A to segregate some of that very 
small amount of otherwise undetectable but highly valuable information from the overwhelming 
amount of other information that has no intelligence value whatsoever — in colloquial terms, to 
find at least some of the needles hidden in the haystack. If employed on a sufficient volume of 



data, contact chaining 
that were previously unknown. 



expose 



and contacts 



56. fFS^SdbWF) The foregoing discussion is not hypothetical. As noted previously, 
since inception of the first FISC Telephone Business Records Order, NSA has provided 275 
reports to the FBI. These reports have provided a total of 2,549 telephone identifiers as being in 
contact with identifiers associated with 
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57, { TS// 8I //OC/N F) Accordingly, adjudication of plaintiffs’ allegations concerning 

the collection of non-content meta data and records about communication transactions would risk 
or require disclosure of critical NS A sources and methods for con tacts of 

terrorist communications as well as the existence of current NS A activities under F!SC Orders, 
Despite media speculation about these activities, official confirmation and disclosure of the 
NSA’s bulk collection and targeted analysis of telephony meta data would confirm to all of our 
foreign adversaries existence these critical intelligence 

capabilities and thereby severely undermine NSA’s ability to gather information concerning 
terrorist connections and cause exceptional harm to national security. 

2. Information Concerning Current FISA Authorized 

Activities and Specific FISC Orders 

58, fP SCT S P// S 1/ /O C//NF) I am also supporting the DNf s state secrets privilege 
assertion, and asserting NSA’s statutory privilege, over information concerning the various 
orders of the Foreign Intelligence Surveillance Court mentioned throughout this declaration that 
authorize NSA intelligence collection activities, as well as NSA surveillance activities conducted 
pursuant to the Protect America Act (“PAA 1 ’) and current activities authorized by the FISA 
Amendments Act of 2008. As noted herein, the three NSA intelligence activities initiated after 
the September 1 1 attacks to detect and prevent a further al Qaeda attack — (i) content collection 
of targeted al Qaeda and associated terrorist-related communications under what later was called 
the TSP; (ii) internet meta data bulk collection; and (iii) telephony meta data bulk collection — 
have been subject to various orders of the FISC (as well as FISA statutory authority) and are no 
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longer being conducted under presidential authorization. The bulk collection of non-content 

transactional data for internet communications was first authorized by the FISC in the July 2004 

FISC Pen Register Order, and the bulk collection of non-content telephony meta data was first 

authorized by the FISC in May 2006. The existence and operational details of these orders, and 

of subsequent FISC orders reauthorizing these activities, remain highly classified and disclosure 

of this information would cause exceptional harm io national security. 25 In addition, while the 

Government has acknowledged the general existence of the January 10, 2007 FISC Orders 

authorizing electronic surveillance similar to that undertaken in the TSP, the content of those 

orders, and facts concerning the NSA sources and methods they authorize, cannot be disclosed 

without likewise causing exceptional harm to national security. Subsequent content surveillance 

sources and methods utilized by the NSA under the PAA and, currently, under the FISA 

Amendments Act of 2008 likewise cannot be disclosed. I summarize below the proceedings that 

have occurred under authority of the FISA or the FISC. 

59. (TS//SI//OC//N F) (a) Internet Meta Data : Pursuant to the FISC Pen Register 
Order, which has been reauthorized approximately every 90 days after it was first issued, NSA is 



authorized to collect m bulk 



meta data associated with 



electronic communications 



5 (T3f/ S F VOC//N F) For this reason, the FISC Telephone Business Records Order and 
FISC Pen Register Orders prohibit any person from disclosing to any other person that the NSA 
has sought or obtained the telephony meta data, other than to (a) those persons to whom 
disclosure is necessary to comply with the Order; (b) an attorney to obtain legal advice or 
assistance with respect to the production of meta data in response to the Order; or (c) other 
persons as permitted by the Director of the FBI or the Director’s designee. The FISC Orders 
further provide that any person to whom disclosure is made pursuant to (a), (b), or (c) shall be 
subject to the nondisclosure requirements applicable to a person to whom the Order is directed in 
the same manner as such person. 
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The NSA is authorized to quay (he archived 
meta data collected pursuant to the FISC Pen Register Order using email addresses for which 
there were facts giving rise to a reasonable, articulable suspicion that the email 



address was associated with 



Order was most recently reauthorized on 



The FISC Pen Register 
2009, and requires continued assistance by the 



providers through 



2009. 



60. (TS // S I//O C//N F) (b) Telephony Mela Daia : Beginning in May 2006, the NSA’s 

bulk collection of telephony meta data, previously subject to presidential authorization, was 
authorized by the FISC Telephone Business Records Order Like the FISC Pen Register Order, 
the FISC Telephone Business Records Order was reauthorized approximately every 90 days. 
Based on the finding that reasonable grounds existed that the production was relevant to efforts 
to protect against international terrorism, the Order required 
produce to the NSA “call detail records'’ or ‘lelephony metadata” pursuant to 50 U.S.C. § 

1 861 [c] (authorizing the production ofbusincss records for, inter alia, an investigation to protect 
against international terrorism). Telephony meta data was compiled from call detail data 
maintained by the providers in the ordinary course of business that reflected non-content 
information such as the date, time, and duration of telephone calls, as well as the phone numbers 
used to place and receis'e the calls. The NSA was authorized by the FISC to query the archived 
telephony meta data solely with identified telephone numbers for which thete were facts giving 



Hr nil 
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rise to a reasonable, articulable suspicion that the number was associated with 

|(or a “RAS” determination)- The FISC Telephone Business 
Records Order was most recently reauthorized on March 2, 20G9> but subject to new specific 
limitations, which l summarize next. 

61. fFS tf S As noted above (note 1 1 supra), on January 1 5, 2009, the 
Department of Justice (“DOT') submitted a compliance incident report related to the Business 
Records Order to the FI$C> based on information provided to DOJ by the NSA, which indicated 
that the NSA’s prior reports to the FISC concerning implementation of the FISC Telephone 
Business Records Order had not accurately reported the extent to which NSA had been querying 
the telephony meta data acquired from carriers. In sum, this compliance incident related to a 
process whereby currently tasked telephony selectors {i,e> phone numbers) reasonably believed 
to be associated with authorized counter terrorism foreign intelligence targets associated with| 

|jnder Executive Order 12333 were reviewed against 
the incoming telephony metadata to determine if that number had been in contact with a number 
in the United States. This process occurred prior to a formal determination by NSA that 
reasonable articulable suspicion existed that the selector was associated with | 

|and was not consistent with NSA’s prior descriptions of the 
process for querying telephony meta data. 

62. E) By Order dated March 2, 2009, the FISC has directed that the 
NSA may continue to acquire call detail records of telephony meta data in accordance with the 
FISC Telephone Business Record Orders, but is prohibited from accessing data acquired except 
in a limited manner In particular, the Government may request through a motion that the FISC 
authorize querying of the telephony meta data for purposes of obtaining foreign intelligence on a 
case-by-case basis (unless otherwise necessary to protect against imminent threat to human life, 
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subject to report to the FISC the next business aay). In addition, the FISC imposed other 
obligations on the Government, including to report on its ongoing review of the matter and to file 
affidavits describing the continuing value of the telephony meta data collection to the national 
security of the United Slates and to certify that the information sought is relevant to an 
authorized investigation, 

63. NSA is committed to working with the FISC 

on this and other compliance issues to ensure that this vital intelligence tool works appropriately 
and effectively. For purposes of this litigation, arid the privilege assertions now made by the 
DNI and by the NSA, the intelligence sources and methods described herein remain highly 




compromise vital NSA sources and methods and result in exceptionally grave harm to national 
security. 



64. (T S //T SftfS iy/O C //NF ) (c) Content Collection : On January 10, 2007, the FISC 
issued orders authorizing the Government to conduct certain electronic surveillance that had 
been occurring under the TSP Those Orders included® 



|the “Foreign Telephone and Email Order,” which 
authorized, inter alia , electronic surveillance of telephone and Internet communications 

| where the Government determined that there was probable 
cause to believe that ( 1 } one of the communicants is a member or agent of | 

I and (2) the communication is to or from a foreign country (i.e., 
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a one-end foreign communication to or from the United States). Thereafter, any electronic 
surveillance that was occurring as part of the TSP became subject to the approval of the FISA 
Court and the TSP was not reauthorized. 27 

65. (TS//ST/OC//NF) The Foreign Telephone and Email Order remained in effect 
until the Protect America Act (“PAA”) was enacted in August 2007. Under the PAA, the FISA’s 
definition of “electronic surveillance” was clarified to exclude “surveillance directed at a person 
reasonably believed to be located outside the United States.” 50 U.S.C. § 1 805A. The PAA 
authorized the DNI and the Attorney General to jointly “authorize the acquisition of 
foreign intelligence information concerning persons reasonably believed to be outside the 
United States” for up to one year, id. § 1805B(a), and to issue directives to communications 
service providers requiring them to “immediately provide the Government with all information, 
facilities, and assistance necessary to accomplish the acquisition” of necessary intelligence 



information, id. § 1805B(e). Such directives were issued 



and the NSA conducted 



content surveillance of overseas targets under the PAA 

2008, expiring directives that had been 
issued under the PAA for content surveillance of overseas targets (including surveillance of 



specific 



targets overseas) were replaced by new directives for such surveillance 



jgj 



Classified fn Camera t £i Paiie DccluraLion of Deborah A. Bonanni, National Security Agency 
Carolyn Jtrhei, et a\. k National Security Agency } el aL 



y^N/NPFOP - N 

.j 1 v i ™; n " 




t 

1 

1 



Ml 
1 J 

} ' 

i5 

If* 



£4 



issued pursuant tot Ik- • 1 ^ \ Xmendnciii-- Vi<j N^'s r -A Ms \ Amendments Vt of 

2t*\\ authorizes fhc targeting ul persons outMdc ol the l ruled Stale* without mdn tdu.il I IS( 
enters hut subject u> JiTCUh es issued to carriers hj the I>uecior of National Intelligence and the 
Attorney Cicueral under Sou ton TM^hJol'the h ISA lor the com \ mutton of* <v cNcjs surveillance 
under thi< new auihonly A</5nl Si $ IK\ljfh)<j> aided by the MS \ Act of 2MK, FM 
l IH-2MJ 

t» 7 l SJ\ JiJ '.'GOT i la sum. the post 4 i t touicni surveillance activities 

lmdortiken h\ the NS \ evolved from the president ally auihnn/cd I SP to the rISC foreign 
I dephone ami f mail Order, in the directives issued under the V\\ ami. ultimately, to the 
dntMivcx that oic n«»w heme issued pursuant to the FISA Amendments \<.i of 200K, Faeh 
lutiion/ation sought So enable ihe \SA in undertake suitcilUnccoit numerous multiple targets 
<n orscas ithoul the need l*> obtain dth a rice court approval lor cadi tisigel. but nunc has emailed 
tin kind *>f tmlisuimiiule mnicnt sui vnlbwce an idephony rim I (nlenict communication* tli.ii 
flic plamtilts allege 

{V) FJainiiffs " Allegations that Al&T Prodded Assistance to the NS A with 
the Alleged Activities. 

(1) Hie tluiii major category ul NS A intelligence sources and methods as to 
which 1 am supporting the L)\r* assertion ol privilege. and asserting the NS AN statutory 
pm degc. concern* information rh at may tend to confirm or deny whether or nm \ f^T (or to tht 
extent necessary whelhei or n»it an> other fclcctwimunkahnn* provider) hu* assisted the N^A 
will. alleged intelligence activities Mainhlf* allege that they are customers o| A 5 L and thal 
Uki part no paled m the alleged surveillance adiv me* that the pktmtitts seek to challenge As 
set loTlh below, continuation or ijema! o! a relationship between Hie NSA and Mil (or other 
carrier' 1 on alleged mielhgencc jl!« vines would cause exceptionally pjw harm in national 






OR N 





2 






72 . 




Classified In Camera, 8x Pane Declaration of Deborah A. Bonanni, National Sccuriiy Agency 
Carolyn Jewel, etai v. National Security Agency, €fal. (No. 

-top 



43 







Classified In Camera, Ex Pane Declaration of Deborah A. Bonannh National Security Agency 
Carolyn ,/ewe/, ef al v. National Security Agency, tt ai (No. Q8-ev^873-VR\V) 





Classified In Camera, Ex Pane Dedaralion of Deborah A Bonfltini h National Security Agency 
Canyon Jcn%i. efal \\ National JectfriVy Agency, ei at. (No^^cv^873-VRW) 

-^FepnREGftfiT/fl SP//5- 1 - 



5 



! 







Clarified In Camera, Ex Pone Dcclurulion of Deborah A* &onanm. National Security Agency 
Coro/)H Jwf/, ei &f. v T bf&ii&na} Secun^ ^ewj-' r ef o/ T ^ 






2 



VII. (U) Risks of Allowing Litigation to Proceed 
80. Upon examination of (he allegations, claims, 

facts, and issues raised by this case, it is myjudgmcnt that sensitive state secrets are so central to 
the subject matter of the litigation that any attempt to proceed will substantially risk the 
disclosure of the privileged state secrets described above. Although plaintiffs’ alleged content 
surveillance dragnet does not occur, proving why that is so, 

would directly implicate highly classified 
intelligence information and activities. Similarly, attempting to address plaintiffs’ allegations 
with respect to the bulk collection of non-content information and records containing 
transactional meta data about communications would also compromise currently operative NSA 
sources and methods that are essentia) (o protecting national security, including for detecting and 



preventing a terrorist attack. 



myjudgmcnt, any effort to probe the outer-bounds of such classified information would pose 



fFStffSfV> < SI//OC) f N f^ In its prior classified declarations in this action, the NSA has 
set forth specific examples of how the intelligence sources and methods utilized by the NSA 
after the 9/1 1 attacks, including content surveillance under the TSP and pursuant to subsequent 
FISA authority, as well as non-content meta data collection and analysis, have led to the 
development by the NSA of actionable intelligence and important counter-terrorism efforts. See. 
e.g.. Classified In Camera , Ex Parte Declaration of LTG Keith B. Alexander in Shubert. el al. v. 
Bush, et al., (Case No. 07-cv-693) (dated May 25, 2007) at 35-43, YU 58-61. To the extent that 
such information would be relevant to any litigation in this action, however, they could not be 
disclosed without revealing specific NSA intelligence information, sources, and methods, and arc 
subject lo the government’s privilege assertion 
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inherent and significant risks of the disclosure of that information, including critically sensitive 
information about NSA sources, methods, operations, target Indeed, any 
effort merely to allude to those facts in a non-classified fashion could be revealing of classified 
details that should not be disclosed. Even seemingly minor or innocuous facts, in the context of 
this case or other non-classified information, can tend to reveal, particularly to sophisticated 
foreign adversaries, a much bigger picture of U.S. intelligence gathering sources and methods. 

8 1 , The United States has an overwhelming interest in detecting and 
thwarting further mass casualty attacks by a) Qaeda. The United States has already suffered one 
attack that killed thousands, disrupted the Nation's financial center for days, and successfully 
struck at the command and control center for the Nation's military. A1 Qaeda continues to 
possess the ability and clear, stated intent to carry out a massive attack in the United States that 
could result in a significant loss of life, as well as have a devastating impact on the U.S. 
economy. According (o the most recent intelligence analysis, attacking the U.S. Homeland 
remains one of a) Qaeda's top operational priorities, see Classified In Camera Ex Parte 
Declaration of Admiral Dennis C. Blair, Director of National Intelligence, and al Qaeda will 
keep trying for high-impact attacks as long as its central command structure is functioning and 
affiliated groups are capable of furthering its interests 

82. ffStfSt / yN P ) Al Qaeda seeks (o use our own communications infrastructure 
againsl us as they secretly attempt to infiltrate agents into the United States, waiting to attack at a: 
time of their choosing. One of the greatest challenges the United States confronts in the ongoing 
effort io prevent another catastrophic terrorist attack against the Homeland is the critical need to 
gather intelligence quickly and effectively. Time is of the essence in preventing terrorist attacks, 
and the government faces significant obstacles in finding and tracking agents of al Qaeda as they 
manipulate modem technology in an attempt to communicate while remaining undetected. The 
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NSA sources, methods, and activities descnbed herein are vital tools in this effort. 

VUI, (U) Conclusion 

S3. (U) [n sum, I support the DNI’s assertion of the state secrets privilege and 

statutory privilege to prevent the disclosure of the information described herein and detailed 
herein. I also assert a statutory privilege under Section 6 of the National Security Act with 
respect to the information described herein which concerns the functions of the NSA. Moreover, 
because proceedings in this case risk disclosure of privileged and classified intelligence-related 
information, 1 respectfully request that the Court not only protect that information from 
disclosure but also dismiss this case to prevent exceptional harm to the national security of the 
United Stales. 

1 declare under penalty of perjury that the foregoing is (me and correct. 



Chief ofStaff 
National Security Agency 





DEBORAH A. BONaNNI 
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